Combating the Insider Threat at the FBI: Real World Lessons Learned - - PowerPoint PPT Presentation

FEDERAL BUREAU OF INVESTIGATION

“Fidelity, Bravery, and Integrity”

Combating the Insider Threat at the FBI: Real World Lessons Learned

Patrick Reidy

2

The views expressed in this presentation are those of the presenter and do not reflect the official policy or position of the Department of Justice, the Federal Bureau of Investigation, or the U.S. Government, nor does it represent an endorsement of any kind.

Disclaimer and Introduction

3

1 Insider threats are not hackers 2 Insider threat is not a technical or “cyber security” issue alone 3 A good insider threat program should focus on deterrence, not detection 4 Avoid the data overload problem 1 Use behavioral analytics

The 5 Lessons

4

Our IA Program & Evolution

Threat focus: Computer intrusion Protection: N/W perimeter, firewalls, IDS, proxies, A/V, DHCP, DNS Detection technique: signature based Threat focus: APT Protection: + Internal N/W, host A/V, OS, application logs, email, net flow Detection technique: + N/W anomaly Threat focus: Insider Protection: + DLP, DRM, Personnel data, data object interaction, non-N/W data Detection technique: + data mining, behavioral

5

The Approach

Known Bad Assumed Good vs.

► Test: 65 espionage cases and the activities of over 200 non-model employees ► Control: The rest of the user population

6

► NOT hackers ► People who joined

• rganizations with no malicious

intent ► Most tools and techniques are designed with the hacker in mind

Lesson #1: The Misunderstood Threat

VS. +

7

► We lose most battles 2 feet from the computer screen ► 24% of incidents, 35% of

• ur time

► The “knuckle head” problem ► Policy violations, data loss, lost equipment, etc. ► Address with user training campaigns & positive social engineering ► 7% drop incidents since last year

Not The “Knuckle Head” Problem

8

The Most Common Threat of Them All!?!? Not So Fast..

9

Joe Says...

► Insider threat is not the most numerous type of threat

► 1900+ reported incidents in the last 10 years ► ~ 19% of incidents involve malicious insider threat actors

► Insider threats are the most costly and damaging

► Average cost $412K per incident ► Average victim loss: ~$15M / year ► Multiple incidents exceed $1 Billion

Sources: Ponemon Data Breach Reports: ‘08, ‘09, ‘10, ’11; IDC 2008; FBI / CSI Reports: ‘06, ‘07, ’08’, ‘09, ‘10/’11; Verizon Business Data Breach Reports: ‘09, ‘10, ‘11, ’12, ’13; CSO Magazine / CERT Survey: ‘10, ’11; Carnegie Mellon CERT 2011 IP Loss Report; Cisco Risk Report ‘08

10

► Data from convictions under the Industrial Espionage Act (IEA) Title18 U.S.C., Section 1831 ► Average loss per case: $472M

FBI Case Statistics IEA 1996 - Present

11

► Authorized people using their trusted access to do unauthorized things ► Boils down to actors with some level of legitimate access, and with some level

• f organizational trust

► Misunderstanding example: The APT is not an insider threat because they steal credentials.

Solution: Define the Insider

12

The Threat Tree

Threats

Environmental Human

Internal Malicious Espionage I/T Sabotage Fraud / abuse IP Theft Non- malicious External Malicious Non- malicious

CERT Threat Models

13

Sysadmins: Evil? Not So Fast…

14

Joe Says…

• 1.5% of espionage cases

reviewed involved the use of system admin privileges

• .8% of internal FBI incidents

involved system admin cases

• CMU Cert show different

statistics for IT sabotage:

• 90% of IT saboteurs were system

admins

• http://www.cert.org/blogs/insider_

threat/2010/09/insider_threat_dee p_dive_it_sabotage.html

15

► The Intrusion Kill Chain is excellent for attacks, but doesn’t exactly work for insider threats

The Intrusion Kill Chain

Reference: Intelligence-Driven Computer Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chain. E.M. Hutchings, M.J. Cloppert, et. al.

16

The Insider Threat Cyber “Kill Chain”

Operational Security

• Recruitment or

cohesion

• Going from “good” to

bad

Recruitment / Tipping point Search / Recon Acquisition / Collection Exfiltration / Action

• Find the data / target
• Less time the more

knowledgeable the threat

• Grab the data
• Data hording
• Game over!
• Egress via printing,

DVDs / CDs, USBs, network transfer, emails

• Hiding

communications with external parties

• Vague searching
• Asking coworkers to

find data for them

• Use of crypto
• Renaming file

extensions

• Off hour transfers
• Spreading data

downloads over multiple sessions

17

► Many want you to believe insider threats are hackers in order to sell you things ► IDS, Firewalls, AV, etc. do not work

► No rules are being broken!

► Question vendor claims

► Some great capabilities, but no “out of the box” solutions ► Data loss prevention, digital rights management, and IP theft protection products are maturing

Beware the Silver Bullet

Click Here to Catch Spy

18

► We trust the threat ► Insider threat programs are not just policy compliance shops ► 90% of problems are not technical

► Programs do not just bolt into Security Operations Centers ► Dedicated staff with clear

• bjectives are a must

Lesson # 2: This is Not a Simple Cyber Security Problem

19

Solution: The Multidisciplinary Approach

Goal:

Detect Deter Disrupt

Personnel

CI / Intel Cyber Security

Enemy People Data Identify: Focus:

20

Do You Know Your People?

Serial #: 1234567

A A A A A A A A

Badge# 2345 IP Addrs: 1.1.1.1 Works for Business Development 703-555-1212 Work schedule Patterns of activity Jdoe@ic.fbi.gov

21

The Whole Person Approach

Psychosocial Contextual Cyber

22

► Who would be targeting your organization? ► Who would they target inside your organization? ► Who are the high risk individuals in your

• rganization?

Know Your Enemy

23

Know Your Data

► What are the crown jewels

• f your organization?

► What data / people would the enemy want to target? ► Action:

► Identify sensitive data ► Rate top 5 most important systems in terms of sensitive data

24

However… ► This is about survival in a hostile market place ► If your data is secure you can penetrate risky markets ► Your enemy is your business partner, are you designed that way?

The Value Proposition of Insider Threat and Data Protection Programs

It’s complex It’s expensive It may take years to achieve tangible results

25

Lesson #3: Focus on Deterrence Not Detection

► Make environment where being an insider is not easy ► Deploy data-centric, not system-centric security ► Crowd-source security ► Use positive social engineering

Risk Averse Risk Takers

26

► Aren’t security subject matter experts the best to make decisions?

► Nope!

► British scientist who wanted to show empirically that educated people are superior ► Asked “commoners” to guess the weight of an ox at a fair ► Results:

► No single villager correct, but average < 2

• lbs. off

► No single SME correct, average SME > 6 lbs off

Solution: Crowdsource Security!

Francis Galton (1822-1911)

27

► 13,900 people come to work armed everyday ► Our people are trusted to enforce the law and keep the country safe

Crowdsourcing Security at the FBI

VS.

If we can train them to use guns, we can train them to use data

28

Solution: Positive Social Engineering

Users will make good decisions given timely guidance Risk reduction with no impact to workflow, etc.

29

Positive Social Engineering: RESULTS!

Source: Internal FBI Computer Security Logs

30

Lesson #4: The Data Overload Problem

0.5 1 6 10 50 160 2048 500 1000 1500 2000 2500 D+1 yr D+2 yr D+3 yr D+4 yr D+5 yr D+6 yr D+7 yr

Data Growth (TB)

Data Growth

Individual Audits Critical App Logs Host Monitoring N/W Monitoring

FEDERAL BUREAU OF INVESTIGATION

“Fidelity, Bravery, and Integrity”

Every time Someone says “BYOD”, god kills a kitten

32

► You don’t need everything ► HR data:

► To “know your people” ► Workplace/personnel issues

► System logs tracking data egress and ingress:

► Printing, USB, CD/DVD, etc.

Solution: Focus on Two Sources

33

► Prediction of rare events (i.e. insider threats) may not be possible ► Don’t waste time and money on the impossible ► Look for red flag indicators as they happen

Lesson #5: Detection of Insiders = Kinda Hard

34

► Most people don’t evolve into true threats ► ~5% of the 65 espionage cases came in “bad” ► There are observable “red flags” we call indicators

The Insider Threat Continuum

Indicators must be observable and differentiating

35

► A rodent out-predicted our first generation systems

The Problem with Prediction

36

The Detection Problem: A Needle in a Stack of Needles

37

► Behavioral based detection

► Think more like a marketer and less like an IDS analyst ► Build a baseline based on users volume, velocity, frequency, and amount based

• n hourly, weekly, and monthly

normal patterns ► Cyber actions that differentiate possible insiders: data exfiltration volumetric anomalies

Solution: Use Behavioral Detection

38

Looking at Averages

► All 5 egress points turned up nothing ► No statically relevant differences ► So what’s going on?

39

The Problem with Assumptions

40

► Standard distributions (bell curves) are very rare ► >80% of data movement done by <2% of population ► Hint: Know your data or make huge analytic mistakes

Findings in Data Movement

Source: Internal FBI Computer Security Logs

Per User Enterprise Data Egress Over 51st Week of 2012

D a t a A m

• u

n t Users

41

Focus on the Individual

• 21% of test users showed a volumetric anomalies in a 90

day window more than once versus 12% of the control

42

1 Insider threats are not hackers.

 Frame and define the threat correctly and focus on the insider threat kill chain

2 Insider threat is not a technical or “cyber security” issue alone

 Adopt a multidisciplinary “whole threat” approach

3 A good insider threat program should focus on deterrence, not detection

 Create an environment that discourages insiders by crowd sourcing security and interacting with users

4 Avoid the data overload problem

 Gather HR data and data egress/ingress logs

5 Detection of insider threats has to use behavioral based techniques

 Base detection on user’s personal cyber baselines

The 5 Lessons & Solutions

43

Questions?

Or sit in uncomfortable silence. Your choice.